Re: [Security-Discuss] problem with 2005 cpio update

On 12-Jul-05, at 7:45 PM, Rolf Pedersen wrote:

>>> $ rpm -K cpio-2.6-3.1.102mdk.i586.rpm
>>> cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa sha1 md5 gpg OK
>>>
>>> $ rpm -K ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/  
>>> updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
>>> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/ 
>>> LE2005/ main_updates/./cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa  
>>> sha1 MD5  GPG NOT OK
>>>
>>>
>>> The downloaded file checks out OK locally.  Guess it is a  
>>> problem  with rpm -K not working over http, or something.  Thanks.
>>>
>>
>>
>> Wierd.  Do you always do an rpm -K over the network before   
>> installing?  Or did urpmi give you a bad message or something  
>> that  made you try that?
>>
>> I wasn't even aware rpm could do that, but I'm not sure why you'd  
>> run  -K on the file before downloading it.
>>
>>
>
> I used to do rpm queries on packages over the network (I use urpm  
> tools much more and rpm much less, now) and tried -K in this  
> instance as I didn't have a copy of the rpm locally.  I can't  
> recall whether it ever worked for me before but my motivation was  
> that I might be able to find out what I needed to know about the  
> integrity of the package w/o having to download the whole rpm, then  
> have a no-longer-needed file on my disk.  Actually, I would expect  
> urpmi to warn me about a bad GPG or md5sum but it was acting in a  
> way I had never seen before (asking for a dependency that was  
> installed), so I tried to {-K|--checksig} the rpm, in a way that  
> is, apparently, not supported. :)

You could have just ran -K on the package in /var/cache/urpmi/rpms... =)

> From the manual:
>
> [..]
> -p, --package PACKAGE_FILE
>              Query  an  (uninstalled) package PACKAGE_FILE.  The  
> PACKAGE_FILE
>              may be specified as an ftp or http style URL, in which  
> case  the
>              package  header  will  be  downloaded and queried.   
> See FTP/HTTP
>              OPTIONS for information on rpm's internal ftp  and   
> http  client
>              support.
> [..]
>
> [..]
> FTP/HTTP OPTIONS
>       rpm  can  act  as  an  FTP  and/or  HTTP client so that  
> packages can be
>       queried or installed from the internet.   Package  files   
> for  install,
>       upgrade,  and query operations may be specified as an ftp or  
> http style
>       URL:
>
>       ftp://USER:PASSWORD@HOST:PORT/path/to/package.rpm
>
>       If the :PASSWORD portion is omitted, the password will be  
> prompted  for
>       (once  per user/hostname pair). If both the user and password  
> are omit-
>       ted, anonymous ftp is used.  In all cases, passive (PASV) ftp  
> transfers
>       are performed.
> [..]
>
> hmmm...
> Maybe it is an ftp/http thing?
>
> $ rpm -K http://gulus.usherbrooke.ca/pub/distro/Mandrakelinux/ 
> official/updates/10.2/main_updates/cpio-2.6-3.1.102mdk.i586.rpm
> http://gulus.usherbrooke.ca/pub/distro/Mandrakelinux/official/ 
> updates/10.2/main_updates/cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa  
> sha1 md5 gpg OK
>
>
> Anyway, a pretty marginal concern, for me, atm ;)

Could be, but regardless, rpm has to download that file first... it  
can't determine the signature or md5 without having the entire file  
AFAIK.  So a) you already had the file downloaded in the urpmi cache,  
and b) you downloaded it again (multiple times) doing the network  
checking.. =)

If you ever have a problem with a package or urpmi complains about  
something, snoop in /var/cache/urpmi first... chances are the file is  
there and you can do your rpm -K and whatnot on the file directly  
(and on the actual file that urpmi is complaining about).

Probably saves more time and in the case of big packages like  
OpenOffice, a fair amount of bandwidth to boot.  =)

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}